Researchers at Exploit Prevention Labs have discovered a large Cyber Criminal gang operating out of Australia. It was found that nearly every bank in Australia had customers who had their bank details used by the criminals. Users in Australia were send what looked like an eCard from Yahoo. The computer user would click on the eCard and be brought to an Exploit server. The Exploit server would check to see what vulnerabilities the users browser had and would use the hole it found to install a Keylogger and a Rootkit to hide the Keylogger. The Exploit Server was using the Webattacker Script which is updated regularly and can be purchased very easily and cheaply.
The user would then be sent to the Yahoo eCard site so as to make it look like a nothing untoward has happened.
Roger Thompson, Exploit Prevention Labs’ CTO, discovered the Australian eCard scam and has been tracking the evolving threat.
“The user receives an eCard in their email inbox,†said Thompson. “The card appears to come through one of the major eCard companies, so it is assumed to be safe, despite the user not recognizing the sender’s name on the card. The user clicks the link to view the card, which doesn’t tell you who it’s really from, so they just close it and continue with whatever they were doing before. Unfortunately, what’s actually happened is that a rootkit has been delivered to the user’s PC before they even pick up the card.â€
“We started tracking MDAC back in June, shortly after WebAttacker was upgraded. Initially, it was just a tiny blip on the radar, registering 0.5% in our Exploit Prevalence Survey for that month. In July, it was up to 3.51%, and last month it reached 6.69%. If that pattern continues, we can expect to see both vendors and traditional anti-malware vendors experiencing significant problems in trying to keep up with the threat.â€
This attack goes to show that unless users have all the latest security updates and patches on their computer they have a bigger chance of falling victim to such an attack. No amount of Anti-Virus or Anti-Spyware can thwart such an attack. Even if a user has a fully patched computer they can still get caught by what are called Zero Day attacks. These are attacks on program holes that the program maker is not yet aware of.
The best way to avoid Rootkits getting onto your PC is to run as an ordinary user and not to have any administrator rights.
Keep Safe
regards
Steo
www.antirootkit.com
